Trust Center
Zero-trust. Zero-PHI. Everything is verifiable on-chain or via public API. We built HIPAA Agent so you never have to take our word for it.
Zero-PHI Architecture
Patient data never enters our system. Here is exactly what flows through.
PHI never enters our system. We scan websites, DNS records, email configurations, SSL certificates, and network infrastructure only. No patient data is collected, processed, or stored at any point in our pipeline.
Encryption
In Transit
At Rest
Blockchain Anchoring
Compliance records are anchored on a public blockchain. No trust required.
Cryptographic Attestations
Every score, grade, and scan result is cryptographically signed.
Ed25519 Digital Signatures
All reputation data — scores, grades, scan results, and metrics — is signed with Ed25519 elliptic curve signatures. The public key is available via API so anyone can independently verify that data originated from HIPAA Agent and has not been tampered with.
SHA-256 Hash Chain
Per-NPI immutable audit trail. Each event is chained to the previous.
Genesis Block
When a practice is first scanned, a genesis block is created with a unique SHA-256 hash. This is the root of the practice's audit chain.
Chained Events
Every subsequent event — scan, finding, grade change, report delivery — includes the previous event's hash in its own hash computation, creating an unbreakable chain.
Tamper Detection
Modifying any event invalidates every hash that follows it. Integrity verification is instant: recompute and compare.
PHI Detection Layer
Active defense against accidental PHI exposure. Every request is scanned.
Automatic PHI Rejection
Every API request is scanned for 18 HIPAA-defined PHI identifiers. If PHI is detected, the request is immediately rejected with a PHI_DETECTED error. The event is logged to the security_events table.
18 PHI Identifiers Scanned
Access Controls
Role-based access, granular scopes, and multi-factor authentication.
Role-Based Access Control
12 OAuth2 scopes control access to every resource. API keys are tiered: free, startup, professional, and platform.
scan:readscan:writefindings:readfindings:writereport:readreport:generatebreach:readreputation:readaudit:readpolicy:readpolicy:writeadmin:allAuthentication
Infrastructure
Vercel Pro
Next.js hosting, global edge network, automatic DDoS protection, zero-config SSL
Hetzner CCX23
Dedicated VPS for scanning operations, EU-grade privacy standards, isolated from application layer
Supabase
PostgreSQL with Row Level Security, automated encrypted backups, real-time audit logging
Resend
Transactional email with DKIM, SPF, and DMARC authentication on all outbound messages
Uptime & Monitoring
Incident Response
Contact & Response
Responsible Disclosure
Safe Harbor for Security Researchers
We welcome good-faith security research. If you discover a vulnerability in HIPAA Agent, we want to hear about it and will work with you to resolve it responsibly.
Verify Our Claims
Everything on this page is independently verifiable. Check the blockchain anchors, verify the cryptographic signatures, or hit the health endpoint right now.